Privacy Policy

YouthPay (also called “Bachat”) helps people in Pakistan understand their spending by reading the bank alert messages they already receive. This policy explains exactly what the app does with your information. It describes the app as it is actually built, not what it might do later.

The short version

• We never ask for your bank login, card number, PIN or OTP.
• Your transactions are stored in your own browser. If you sign in, they also sync to your own account so they follow you between devices.
• If you connect Gmail, we only read messages that look like bank alerts, and only to turn them into transactions. We do not store your emails.
• We do not sell your data, show ads, or run analytics on your spending.

Information we handle

Your email address. Used only to sign you in. YouthPay is passwordless: we email you a one-time link. We never store a password because we never create one.

Your name. Whatever you type during setup. Used to address you in the app and to show a linked parent who they are connected to.

Transactions. The amount, date, merchant, category, bank name and original alert text for each transaction you add or import.

Google user data (only if you connect Gmail). Described in its own section below.

We do not knowingly collect a date of birth, address, phone number, national identity number, or any bank account credential.

Google user data and the Gmail API

Connecting Gmail is optional. The app works fully without it: you can upload alert files, paste an SMS, or type a spend in by hand.

What we request. A single read-only permission,gmail.readonly. We cannot send, delete or change anything in your mailbox.

Why we need it.Pakistani banks send transaction alerts by email. Reading those alerts is the only way the app can build your spending picture automatically instead of making you type every purchase. A read-only permission is the narrowest one that allows this; there is no narrower Gmail permission that still lets us read an alert’s contents.

What we actually read. Not your whole mailbox. We run a search restricted to bank and wallet senders and to alert-shaped subjects and phrases, over a time window you choose. Only messages matching that search are retrieved.

What we do with it.A matching message is passed through our parser, which extracts the amount, date, merchant and type. The resulting transactions are returned to your browser. Parsing happens in our application server’s memory during the request and the message content is discarded when the request ends.

What we store. No email content, subjects, senders or attachments are written to our database or to any log. The only Gmail-derived information kept is the transaction fields listed above, which live in your browser and, if you are signed in, in your own account row.

Your Google tokens. Stored in a secure, HTTP-only cookie in your browser, so they are not readable by scripts. They expire after seven days. You can revoke access at any time at myaccount.google.com/permissions, which immediately stops all further access.

Limited Use disclosure

YouthPay’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features described in this policy.
• We do not transfer Google user data to third parties, except as needed to provide these features, for security purposes, or to comply with the law.
• We do not use Google user data for advertising of any kind.
• We do not allow humans to read Google user data, unless we have your explicit consent for a specific message, it is necessary for security or to comply with the law, or the data has been aggregated and de-identified.
• We do not use Google user data to train generalised artificial intelligence or machine learning models.

Where your data lives

In your browser.Transactions, savings goals, budgets, progress and preferences are saved in your device’s local storage. If you never sign in, that is the only place they exist and they never leave your device.

In your account. If you sign in, your transactions, name and email are stored with Supabase, our database provider, so your data follows you to another device. Database rules restrict every row to the account that owns it.

A parent’s own spending. If a parent tracks their own spending in the app, that data stays on their device and is never uploaded.

Sharing with a parent

Sharing is optional and off by default. To connect, you generate a one-time code and send it to your parent. When they enter it, you receive a request. Nothing is shared until you approve it.

An approved parent sees your spending totals, categories, trends and your full transaction list — merchant, amount and time — for the linked account. They do not see your savings goals, budgets, progress or anything from other parts of the app. You can end the connection at any time from Me → Family, and their access stops immediately.

Service providers

• Supabase, database and sign-in for accounts.
• Vercel, hosting for the application.
• Resend, delivery of sign-in emails.
• Google, only if you choose to connect Gmail.

We do not use advertising networks, analytics or tracking services, and we do not sell or rent your information to anyone.

Keeping and deleting your data

Data stays until you remove it, and everything below is something you can do yourself, right now, without asking us:

• Clear everything on this device — Me → Reset all data.
• Take a copy first — export your transactions to a CSV file from the report screen.
• Disconnect Gmail — revoke access at myaccount.google.com/permissions. We stop receiving anything immediately.
• Cut off a parent — Me → Family → Remove access, which takes effect at once.

Young people

YouthPay is built for teenagers and their parents. It is intended for people aged 13 and over. We deliberately keep what we collect to a minimum, and a teenager stays in control of what a parent can see.

Changes

If this policy changes we will update the date at the top of this page.

Contact

YouthPay is a small project and does not run a support inbox yet, so the controls above are the way to remove your data. If you need something they do not cover, please wait for a contact address to be published here.